1. How this Addendum works
Voxa is established in the United Kingdom and applies UK and EU data protection standards to everyone. Some countries give additional or differently framed rights, and a few impose specific conditions on transferring data out of the country. This Addendum sets those out.
It supplements our Participant, Researcher and Website Visitor Privacy Notices. Where a section below conflicts with those notices, the section prevails for people in the country it covers. Sections you are not covered by do not apply to you.
If this Addendum is translated into another language, the English version governs in the event of any conflict.
Use the Contact page and choose Privacy and data rights. Signed-in users can also use Account & privacy to update preferences, download an account export or request deletion.
2. European Economic Area and Switzerland
If you are in the EEA, the EU GDPR applies to our processing of your personal data alongside the UK GDPR, and every right described in our Data Protection and Your Rights document is available to you. You may complain to the supervisory authority in the country where you live, where you work, or where you believe an infringement occurred.
If you are in Switzerland, the Federal Act on Data Protection applies. Your rights are broadly equivalent, and you may complain to the Federal Data Protection and Information Commissioner. The Swiss Act also protects the data of legal entities; where you deal with us through a Swiss company, that company has equivalent rights over data about it.
Where required by Article 27 of the EU GDPR, we appoint a representative in the Union and publish its contact details in the privacy notice for your role. You may contact that representative on all issues relating to our processing.
3. China
This section applies to individuals in the People's Republic of China under the Personal Information Protection Law and its implementing regulations ("PIPL"). "Personal information" and "process" have their PIPL meanings.
Sensitive personal information. Your identity document details, payment information, religious beliefs, health information and sexual orientation may be sensitive personal information under the PIPL. Leaking or misusing it could harm your dignity or your personal or property safety. We process it only for the purposes described in our Participant Privacy Notice, only where it is necessary for those purposes, and with security measures appropriate to its sensitivity. Every optional sensitive answer is opt-in and you can delete it at any time.
Consent and its alternatives. We may process your personal information without separate consent where it is necessary to conclude or perform a contract to which you are a party; necessary to perform a statutory duty or obligation; necessary to respond to a public health emergency or protect an individual's life, health or property; or where the information has already been lawfully made public by you or through another lawful source and we process it within a reasonable scope.
Sharing and public disclosure. Before we transfer your personal information to a business transferee (for example in a merger or acquisition) we will inform you of the recipient's name and contact details. The recipient must comply with our Privacy Notice; if it wants to process your information for a different purpose or by a different method, it must obtain your consent. We will not publicly disclose your personal information without your prior separate consent, unless Chinese law, a legally binding enforcement action or a court order requires it.
Cross-border transfers. We are headquartered in the United Kingdom and our systems are located there. Transferring your personal information out of China is therefore inherent in using Voxa. We will obtain your separate consent, or rely on another basis available under the PIPL, and will adopt an applicable lawful transfer mechanism where the PIPL requires one. We take measures to ensure overseas recipients provide protection meeting the PIPL's standard.
Security incidents. If a security incident occurs we will take remedial action immediately and notify the relevant authorities and affected individuals where the PIPL requires it.
Your rights. You may access, copy, correct, restrict or object to the processing of your personal information, withdraw consent, and request an explanation of our processing rules. You may also request deletion where the purpose has been achieved or cannot be achieved or the information is no longer necessary; where we stop providing the service or the retention period expires; where you withdraw consent and we relied on it; where our processing breaches Chinese law or our agreement with you; or in other circumstances provided by Chinese law. Your close relatives may exercise these rights in respect of a deceased person's information, subject to that person's own arrangements.
4. India
This section applies to individuals in India. It reflects the Digital Personal Data Protection Act 2023 ("DPDP Act") and, so far as they continue to apply, the Information Technology Act 2000 and the Reasonable Security Practices Rules 2011.
Notice and consent. Where we rely on your consent, we give you notice of what personal data we process and for what purpose, in plain language, and you may give or refuse consent freely. You may withdraw consent at any time with the same ease as you gave it. Withdrawal does not affect processing carried out before it, and where processing was necessary to provide the service, withdrawing may mean we can no longer provide part of it.
Legitimate uses. We may process personal data without consent for certain specified legitimate uses under the DPDP Act, including where you voluntarily provide data for a purpose and have not indicated that you object, and to comply with a legal obligation or a court order.
Your rights. You have the right to access a summary of the personal data we process and the processing activities we undertake, together with the identities of any other data fiduciaries and processors with whom we have shared it; the right to correction, completion, updating and erasure; the right to nominate another individual to exercise your rights if you die or become incapacitated; and the right to a readily available means of grievance redressal.
Grievance redressal. Raise a grievance through the Contact page, choosing Privacy and data rights. We will respond within the period the DPDP Act requires. If you are not satisfied with our response, or we do not respond, you may complain to the Data Protection Board of India. Our Grievance Officer can be contacted through the same route.
Children. Voxa is not available to anyone under 18, and we do not knowingly process the personal data of a child or of a person with a disability who has a lawful guardian.
5. Japan
This section applies to individuals in Japan under the Act on the Protection of Personal Information ("APPI"). "Personal data" has its APPI meaning.
Purpose of use. We use your personal data for the purposes set out in our Participant, Researcher and Website Visitor Privacy Notices. We will not use it beyond those purposes without your consent, except where the APPI permits.
Sharing and entrustment. We will not provide your personal data to a third party without your consent except in cases permitted by the APPI. Where we entrust the handling of personal data to the providers listed in our Service Providers and Sub-processors register, we do so under agreements requiring appropriate management measures to prevent leakage, and we supervise them. An entrusted party may not use the data beyond the scope of the entrustment or the purposes set out in our notices.
Cross-border transfers. We are headquartered in the United Kingdom and some recipients are outside Japan. Some destination countries may not have a personal data protection regime equivalent to Japan's. In those cases we oblige the recipient by contract to implement appropriate security management, we supervise them, and we apply measures such as encryption in transit and at rest to protect the data. On request we will give you information about the destination country's regime and the measures the recipient takes.
Your rights. To the extent permitted by the APPI you may request disclosure of the personal data we hold about you and of our records of third-party provision, correction, addition or deletion, cessation of use or erasure, and cessation of provision to third parties. You may also complain to the Personal Information Protection Commission.
6. South Korea
This section applies to individuals in the Republic of Korea under the Personal Information Protection Act ("PIPA").
Consent. Where PIPA requires consent, we obtain it separately for each of: collection and use of personal information; collection and use of sensitive information and unique identifiers; provision of personal information to third parties; and transfer of personal information overseas. You may refuse any of these, although refusing consent that is essential to the service may mean we cannot provide it.
Overseas transfer. Voxa's systems are in the United Kingdom, so using the service involves transferring your personal information overseas. Before that transfer we notify you of the items transferred, the destination country and the date and method of transfer, the recipient's name and contact details, the recipient's purposes and retention period, and your right to refuse. Our Service Providers and Sub-processors register and our International Data Transfers document contain these details.
Your rights. You may access your personal information, correct or delete it, suspend its processing, withdraw consent, and request an explanation of and object to a decision made by a fully automated system where it significantly affects your rights. You may exercise these rights through the Contact page, or through a legal representative or authorised agent.
Remedies. You may apply for dispute mediation to the Personal Information Dispute Mediation Committee, or report an infringement to the Personal Information Protection Commission or the Korea Internet & Security Agency's privacy call centre.
7. Brazil
This section applies to individuals in Brazil under the Lei Geral de Proteção de Dados ("LGPD").
Legal bases. We process personal data on the bases set out in our privacy notices, which map to the LGPD's legal bases: performance of a contract, compliance with a legal obligation, legitimate interests, and consent for sensitive personal data and optional processing. Where we rely on legitimate interests, you may request information about the balancing test we carried out.
Your rights. You may confirm whether we process your data and access it; correct incomplete, inaccurate or out-of-date data; anonymise, block or delete unnecessary or excessive data or data processed unlawfully; obtain portability to another provider; delete data processed on the basis of consent; obtain information about public and private entities with which we have shared data; be informed about the consequences of refusing consent; withdraw consent; and request review of decisions made solely on the basis of automated processing.
International transfers. Transfers out of Brazil are made on the basis of contractual clauses providing the guarantees the LGPD requires, together with the safeguards described in our International Data Transfers document.
You may complain to the Autoridade Nacional de Proteção de Dados. Requests and complaints reach our data protection contact through the Contact page.
8. Canada
This section applies to individuals in Canada under the Personal Information Protection and Electronic Documents Act ("PIPEDA") and substantially similar provincial laws, including Quebec's Law 25.
Consent and purposes. We identify the purposes for collecting personal information at or before the time of collection, and we obtain consent appropriate to the sensitivity of the information. You may withdraw consent at any time, subject to legal or contractual restrictions and reasonable notice, and we will tell you what withdrawal means for the service.
Your rights. You may request access to the personal information we hold about you and information about how it has been used and to whom it has been disclosed, and you may challenge its accuracy and completeness and have it amended. We respond within 30 days, or tell you if we need an extension the law permits.
Quebec. If you are in Quebec, you also have the right to data portability, the right to be informed when a decision is based exclusively on automated processing and to submit observations to a person able to review it, the right to request that we cease disseminating your information or de-index a link where dissemination contravenes the law or a court order, and the right to be notified of a confidentiality incident presenting a risk of serious injury. We have designated a person responsible for the protection of personal information, reachable through the Contact page.
Transfers outside Canada. Your personal information is processed in the United Kingdom and may be accessible to courts and authorities there under that jurisdiction's law. We assess transfers before making them and use contractual protections. You may complain to the Office of the Privacy Commissioner of Canada or to your provincial authority, including the Commission d'accès à l'information du Québec.
9. Australia and New Zealand
If you are in Australia, the Privacy Act 1988 and the Australian Privacy Principles apply to our handling of your personal information. We collect only what is reasonably necessary for our functions, we tell you why at the time of collection, and we take reasonable steps to keep it accurate and secure.
Sensitive information, which includes health information and information about racial or ethnic origin, political opinions, religious beliefs and sexual orientation, is collected only with your consent: every such answer on Voxa is optional and opt-in.
Cross-border disclosure. Your personal information is stored and processed in the United Kingdom, and may be disclosed to the providers in our Service Providers and Sub-processors register, which are located in the United Kingdom and the United States. We take reasonable steps to ensure overseas recipients do not breach the Australian Privacy Principles.
You may request access to and correction of your personal information through the Contact page. If you are not satisfied with how we handle a privacy complaint, you may complain to the Office of the Australian Information Commissioner.
If you are in New Zealand, the Privacy Act 2020 and its Information Privacy Principles apply on a broadly equivalent basis, and you may complain to the Office of the Privacy Commissioner.
10. Everywhere else
If you are in a country not covered above, we still apply the UK and EU GDPR standards described in our privacy notices as our baseline: a lawful basis for everything we do, data minimisation, defined retention periods, transparency about providers and transfers, and the full set of rights in our Data Protection and Your Rights document.
Where your local law gives you rights that go beyond that baseline, tell us and we will honour them. We would rather apply a higher standard than argue about jurisdiction.